Impacket secretsdump LSASS/NTDS Credential Dumping Detection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects unauthorized attempts to access or dump credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule monitors for execution of known credential-dumping tools (e.g., secretsdump), cross-process access to lsass.exe, suspicious process command-line arguments (e.g., comsvcs, MiniDump), and the creation of files indicative of credential theft (e.g., lsass.dmp, wceaux.dll).